IDENTITY PROVIDER

Set up sign-in for your Freeish instance.

Freeish requires an OpenID Connect identity provider before anyone can access its device-management pages. The versioned self-hosted server release includes Keycloak; you can also connect another compatible provider.

Connect the provider

Create a client for Freeish in your identity provider. Set its redirect URI to your Freeish instance's /auth/callback address, then configure OIDC_ISSUER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, and OIDC_REDIRECT_URI on the Freeish web app.

Send the claims Freeish needs

The access token must have your provider's issuer, include the client ID in its audience (aud), and carry a flat role claim with admin or read_only. In Keycloak, use an Audience mapper and a role-claim mapper. A nested realm_access.roles claim alone is not enough.

Test sign-in and confirm Freeish opens the correct organization before exposing your instance to others.